PAIA Manual

01 Introduction

This manual is published in terms of section 51 of the Promotion of Access to Information Act, 2000 (“PAIA”), as read with the Protection of Personal Information Act, 2013 (“POPIA”). It is intended to assist any person who wishes to request access to records held by Lex Sentry (Pty) Ltd (the “Company”), and to set out how such requests are handled. PAIA gives effect to the constitutional right of access to information held by another person where that information is required for the exercise or protection of any right.

02 Particulars of the Company

03 The Information Regulator’s Guide on how to use PAIA

The Information Regulator has compiled a guide, in terms of section 10 of PAIA, containing information to assist a person wishing to exercise a right of access to information. The guide is available in each official language and can be obtained from the Information Regulator:

04 Records available in terms of other legislation

Certain records may be accessible in terms of other legislation, without recourse to PAIA. These may include records kept under, among others:

• Companies Act, 2008
• Income Tax Act, 1962 and Tax Administration Act, 2011
• Value-Added Tax Act, 1991
• Basic Conditions of Employment Act, 1997 and Labour Relations Act, 1995
• Financial Intelligence Centre Act, 2001 (FICA)
• Protection of Personal Information Act, 2013 (POPIA)

05 Categories of records held by the Company

The Company holds records in the following broad categories. Listing a category does not mean access will automatically be granted; requests are assessed against the grounds for refusal in PAIA.

• Corporate & statutory — incorporation documents, registers, resolutions, and statutory filings.
• Financial — accounting records, invoices, bank records, tax records, and audited statements.
• Client engagement — service agreements, operator agreements, proposals, and correspondence (subject to confidentiality and privilege).
• Human resources — employee contracts, payroll, and personnel records.
• Operational & technical — security policies, system documentation, incident records, and supplier agreements.
• Marketing — website content, enquiries, and contact records.

06 How to request access to a record

A requester must:

• Complete the prescribed Form 2 (Request for Access to Record of Private Body).
• Submit the form to the Information Officer at the contact details in section 2.
• Provide sufficient detail to identify the record and the requester, and the form of access required.
• Identify the right the requester is seeking to exercise or protect, and explain why the record is required for that purpose.
• Pay the prescribed request fee and any applicable access fee (see section 7).

The Information Officer will respond within 30 days, which period may be extended in the circumstances permitted by PAIA.

07 Fees

Two types of fees apply, as prescribed in the PAIA regulations:

• A request fee, payable on submission of the request (other than for a request for the requester’s own personal information).
• An access fee, calculated on the cost of reproduction, search, and preparation, payable before records are released.

The current prescribed amounts are set out in the regulations to PAIA and are available from the Information Regulator.

08 Grounds for refusal of access

The Company may refuse a request on any of the grounds set out in Chapter 4 of Part 3 of PAIA, including:

• Mandatory protection of the privacy of a third party who is a natural person.
• Mandatory protection of commercial information of a third party.
• Mandatory protection of confidential information of third parties.
• Mandatory protection of the safety of individuals and the protection of property.
• Mandatory protection of records privileged from production in legal proceedings.
• Protection of the commercial activities of the Company.
• Protection of research information of the Company or a third party.

09 Remedies available to a requester

There is no internal appeal against a decision of a private body. A requester who is dissatisfied may:

• Lodge a complaint with the Information Regulator in the prescribed manner; or
• Apply to a court for appropriate relief, in terms of section 78 of PAIA, within the prescribed period.

10 Processing of personal information (POPIA)

In accordance with the POPIA amendments to PAIA, the following is recorded in respect of personal information processed by the Company. Full detail of how we handle personal information is set out in our Privacy Notice.

Purpose of processing

To provide cybersecurity and compliance services, to administer client and supplier relationships, to comply with legal and regulatory obligations, and to operate and secure our business.

Categories of data subjects and their personal information

• Clients and prospective clients — contact and engagement information.
• Employees and contractors — HR and payroll information.
• Suppliers and service providers — contact and contractual information.
• Website visitors — limited technical data.

Categories of recipients

Operators and service providers under written agreement, professional advisers, and regulatory or law-enforcement bodies where required by law.

Cross-border transfers

Where personal information is transferred outside South Africa, the Company applies the safeguards required by section 72 of POPIA.

Security safeguards

The Company applies appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information.

11 Availability of this manual

This manual is available:

• On this website at www.lexsentry.co.za/paia-manual.html;
• At the registered office of the Company, on request; and
• From the Information Regulator.

12 Updates

This manual is reviewed periodically and updated as necessary. The “last updated” date above reflects the most recent revision.